A connected_repositories field in client log exports lists the connected repositories a package was served through, so you can trace a download back from the repository that served it…
You can now provision Cloudsmith team membership from groups in your identity provider (IdP) on Ultra and Enterprise plans. Adding or removing a user from a mapped group in your IdP updates their Cloudsmith team membership automatically…
The Cloudsmith CLI has had six releases since our last update here. The headlines: you can now push Nix packages, let Cargo and pnpm authenticate automatically with credential helpers, and manage a repository's GNU Privacy Guard (GPG) key and access privileges without leaving your terminal. Along the way, the CLI got faster to start, kinder to macOS users, and better behaved on machines with no OS keyring…
Package logs are now available in the Cloudsmith web app, giving you a per-package audit trail: what changed, who changed it, and when…
You can now apply cooldown policies to Cargo packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
You can now apply cooldown policies to Conda and Docker packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
Library registries provide a vendor-curated feed of open source packages. Packages may be pre-vetted, rebuilt from source, and security scanned by the vendor…
Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels…
Following early access, policy management - Cloudsmith's policy-as-code system for enforcing rules across your software supply chain - is now generally available across the web app, API, and Terraform provider…
Every package in your workspace is now checked automatically against known vulnerabilities and malicious packages, with no scheduled or manual rescans required. This is powered by OSV.dev, which has driven policy evaluation since early access and now also replaces Trivy as the data source shown in the web app and API…